This week's threat report: a single stolen credential at IT management vendor ConnectWise gave attackers a route into 173 Microsoft 365 tenants worldwide.
NHS England has issued a high-severity alert after attackers were caught exploiting BeyondTrust's remote support software with custom malware.
A critical flaw in Palo Alto's PAN-OS firewalls is being actively exploited and is now on the US government's known-exploited list.
Ivanti has confirmed a second actively exploited flaw in its Connect Secure VPN this month.
Microsoft's October update round fixed 1,413 vulnerabilities, including three zero-days already being used in the wild. Read on to find out more...
ConnectWise Cloud Backup (formerly SkyKick) is a backup tool used by managed service providers (MSPs), with broad OAuth access to customers' mailboxes, files and directory data.
Attackers got hold of a compromised credential belonging to the app itself, not a single customer, and used it to sign in to 173 different partner and customer Microsoft 365 tenants in the space of a few hours on 15 October, working through accounts in a fixed, scripted order, a clear sign of an automated attack. In at least one tenant, a second ConnectWise-linked app was used to grant itself full Global Administrator rights and plant new credentials in other trusted apps, including one belonging to security firm Huntress, extending the attacker's reach well beyond the original compromise.
Microsoft has confirmed it is tracking the incident as an active supply-chain attack, and ConnectWise switched off the affected backup service network-wide while it investigates; as of 18 October, the service remained down.
Many NHS trusts, GP practices and healthtech suppliers rely on MSPs for day-to-day IT support, including hosted backup and Microsoft 365 management, exactly the kind of third-party access this incident abused. A supplier's security failure can become your security incident even when your own systems were never touched directly, which is precisely the third-party risk DSPT's data security standards ask organisations to assess. Anyone working with an MSP, directly or through an IT partner, should find out whether ConnectWise tools sit anywhere in that chain.
Recommendations:
NHS England's National Cyber Security Operations Centre has issued a High-severity alert after confirming attackers are actively exploiting a flaw in BeyondTrust's Remote Support and Privileged Remote Access products, tools widely used by IT teams and suppliers to remotely access and troubleshoot systems.
The vulnerability, CVE-2026-102764, scores 9.3 out of 10 and lets an attacker bypass authentication by spoofing their identity, effectively walking through the front door without a valid key. NHS England says it has seen evidence of real-world exploitation involving custom-built malware and webshells left behind so attackers can return later, and assesses that further attacks are "highly likely". Affected versions are Remote Support 26.2.3 and earlier.
Remote support tools are, by design, given deep access to the systems they manage, which makes them an attractive target and a serious risk if compromised, particularly for NHS trusts and suppliers who rely on third-party IT support.
A single compromised remote-access session can be used to move across a network, reach patient data or disrupt clinical systems. Under DSPT, organisations are expected to know what remote-access tools are deployed across their estate and to patch promptly against actively exploited vulnerabilities such as this one, delay here carries real operational risk, not just theoretical risk.
Recommendations:
Palo Alto Networks has confirmed active exploitation of a code injection vulnerability, CVE-2026-0322, CVSS 8.6, affecting its widely-used PAN-OS firewall software across versions 10.2 through to the latest 12.2 release. An authenticated attacker with network access to a firewall's management interface can use the flaw to execute code with root-level privileges, effectively gaining full control of the device.
The vulnerability has been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue, a list reserved for flaws confirmed to be used in real attacks. Cloud-delivered NGFW and Prisma Access services are not affected; this is specific to on-premises PAN-OS firewalls.
Firewalls sit at the edge of a network specifically to keep attackers out, so a flaw that lets someone take root control of one is about as serious as it gets. A compromised firewall can be used to monitor, redirect or intercept all the traffic passing through it, including traffic to and from clinical and patient-facing systems. For NHS suppliers and digital health organisations running PAN-OS at their network perimeter, this is a patch-now issue, and DSPT's expectation that organisations manage vulnerabilities in internet-facing infrastructure applies directly here.
Recommendations:
has confirmed that a vulnerability in its Connect Secure VPN appliance, CVE-2026-104935, CVSS 8.6, is being actively exploited, allowing an unauthenticated remote attacker to run arbitrary commands by spoofing their identity to bypass authentication.
Affected versions are those prior to 25.1.1.1, 25.1.2.2 and 22.8R2.4. NHS England has rated this a Medium-severity alert but assesses that further exploitation is "highly likely" given confirmed real-world attacks. Ivanti's VPN products have been repeatedly targeted by attackers over the past two years, making this the latest in a pattern rather than an isolated incident.
VPN appliances like Connect Secure are often the front door into an organisation's internal network for remote and home workers, a group that, in health and care settings, can include clinicians, community staff and third-party suppliers. An unauthenticated, remotely exploitable flaw in that front door is a direct route into systems that may otherwise be well defended. Given Ivanti VPNs' exploitation history, any NHS supplier or digital health organisation still running an affected version should treat this as urgent rather than routine patching.
Recommendations:
October 2026 round of security updates addressed 1,413 vulnerabilities across Windows Server, .NET Framework and other products, an unusually large release. Three of the fixes are for zero-day vulnerabilities, meaning they were being exploited or were publicly known about before a patch was available.
The most serious, CVE-2026-96951, is a Windows Shell flaw, CVSS 8.8, already confirmed as exploited and added to CISA's Known Exploited Vulnerabilities catalogue. The update round also marked the end of support for Windows 11 24H2 Home and Pro editions and Windows 10 Enterprise LTSB 2016, meaning those versions no longer receive security updates at all.
A single Patch Tuesday fixing over 1,400 vulnerabilities is a reminder of just how much needs to be kept current across a typical IT estate, and the active zero-day is exactly the kind of issue attackers move quickly to exploit once it becomes public. For NHS organisations and suppliers, the added complication is that end-of-support devices unsupported Windows versions are effectively unpatchable going forward, which is a direct problem for DSPT compliance given its explicit expectations around supported software and timely patching.
Recommendations:
Staying ahead of threats like these takes constant vigilance, and not every organisation has the time or resources to manage it alone.
If you'd like help understanding your exposure to the vulnerabilities above, tightening up your supplier and remote-access risk, or working towards DSPT compliance, get in touch with the Periculo team today.